php 如何在两个不同的域中使用 cookie？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/315132/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How do I use cookies across two different domains?
提问by danielrsmith
I need to share SSO information between two different domains with a cookie, can this be done in PHP and how?
我需要使用 cookie 在两个不同域之间共享 SSO 信息，这可以在 PHP 中完成吗？如何完成？
采纳答案by Adam Davis
On both domains, place an image or other web element that is pulled from the other domain. Use the URL to notify the other domain that user X is on domain A, and let domain B associate that user ID with that user on their system.
在这两个域上，放置从另一个域中提取的图像或其他 Web 元素。使用 URL 通知其他域用户 X 在域 A 上，并让域 B 将该用户 ID 与其系统上的该用户相关联。
It's a little complex to carry out correctly, but if you think it through it'll work out very well.
正确执行它有点复杂，但如果你仔细考虑它会很好地工作。
Vinko points out in a comment (thanks!) that I shouldn't take it for granted that you understand the security risks involved. If this information is of any value to anyone, then you should make sure you use proper encryption, authentication, etc to avoid releasing sensitive information and to avoid various attacks (replay, man in the middle, etc). This shouldn't be too onerous since you control both websites and you can select a secure secret key for both, since the communication is only going between the two servers via this special URL. Keep it in mind though.
Vinko 在评论中指出（谢谢！）我不应该认为您了解所涉及的安全风险是理所当然的。如果此信息对任何人都有价值，那么您应该确保使用适当的加密、身份验证等，以避免发布敏感信息并避免各种攻击（重播、中间人等）。这应该不会太麻烦，因为您可以控制两个网站，并且可以为这两个网站选择一个安全的密钥，因为通信仅通过这个特殊的 URL 在两个服务器之间进行。记住它。
-Adam
-亚当
回答by Adam Davis
If you have two sites using the same domain and would like to share cookies between them, set something like this in your settings.phpfile for each domain:
如果您有两个站点使用相同的域并希望在它们之间共享 cookie，请在您的settings.php文件中为每个域设置如下内容：
ini_set('session.cookie_domain', '.EXAMPLE.com');
Be sure you include the leading '.' before the domain name, or it won't work.
确保包含前导的 '.' 在域名之前，否则它将不起作用。
This allows users to maintain login status between any sites configured for domain-wide cookies.
这允许用户在为域范围 cookie 配置的任何站点之间保持登录状态。
This can also have negative side effects, so don't do this unless you're familiar with all the cookies involved for the sites you want to share cookies between.
这也会产生负面影响，因此除非您熟悉要在其间共享 cookie 的站点所涉及的所有 cookie，否则不要这样做。
回答by chews
You don't, cookies are bound to a domain. There are restrictions on this and it's referred to as cross site scripting.
你没有，cookies 绑定到一个域。对此有限制，它被称为跨站点脚本。
Now, for some help to your problem. What you can do is create a script that helps bridge them.
现在，为您的问题提供一些帮助。您可以做的是创建一个有助于桥接它们的脚本。
You can globally rewrite all links to your second site are going to need cookie information from the first site.
您可以全局重写所有指向您的第二个站点的链接，这些链接将需要来自第一个站点的 cookie 信息。
You would save all the cookies from site-a to a database that they both can read, then programatically appending the cookie-id querystring on all of the links to site-b, then you lookup that cookie id and re-set the cookies under the new domain.
您可以将站点 a 中的所有 cookie 保存到他们都可以读取的数据库中，然后以编程方式将 cookie id 查询字符串附加到站点 b 的所有链接上，然后查找该 cookie id 并重新设置下的 cookie新域。
There is a really good PHP database abstraction library (PHP ADODB) and it has a session sharing plugin that makes all of this a whole lot easier.
有一个非常好的 PHP 数据库抽象库 ( PHP ADODB)，它有一个会话共享插件，使这一切变得更加容易。
回答by chews
Well, if your domains are just different subdomains you could do it in an easy way by creating a .yourdomain.comcookie. Then the cookie is passed along with all the requests across all the subdomains.
好吧，如果您的域只是不同的子域，您可以通过创建.yourdomain.comcookie以一种简单的方式来完成。然后 cookie 与所有子域中的所有请求一起传递。
It's not that simple if you want to share cookies between different domains as browsers treat it as a security risk.
如果您想在不同域之间共享 cookie，这并不是那么简单，因为浏览器会将其视为安全风险。
What is the exact example?
确切的例子是什么？
In case of some software like Google Analyticsand other tracking images, etc. you might be forced to use P3Pheaders to let browser know you don't care about security when sending your cookies. Then a browser requesting image gets a cookie as part of the response and also inspects P3P. If all is OK it saves the cookie on the hard drive and the next time you request an image that sits on your website (but is part of other domains page) the browser will send the cookie along. But I guess this does not help ;-)
对于某些软件，例如Google Analytics和其他跟踪图像等，您可能会被迫使用P3P标头来让浏览器知道您在发送 cookie 时并不关心安全性。然后，请求图像的浏览器获取 cookie 作为响应的一部分，并检查 P3P。如果一切正常，它会将 cookie 保存在硬盘驱动器上，下次您请求位于您网站上的图像（但属于其他域页面的一部分）时，浏览器将一起发送 cookie。但我想这无济于事;-)
I have never used a cookie value across domains in a direct meaning of it.
我从来没有直接使用跨域的 cookie 值。
回答by KDrewiske
I'm not sure about the security implications, but there is an Apache setting that allows you to change the domain of a cookie.
我不确定安全隐患，但有一个 Apache 设置允许您更改 cookie 的域。
# in httpd.conf (or equivalent)
php_value session.cookie_domain mydomain.com
I have successfuly employed this method for subdomains, but have never attempted for different domains.
我已经成功地将这种方法用于子域，但从未尝试过用于不同的域。
There is also a method to set the variables direction in PHP described at http://us.php.net/manual/en/function.session-set-cookie-params.php. The documentation makes no reference to the ability or inability to set cookies on a different domain.
还有一种方法可以在http://us.php.net/manual/en/function.session-set-cookie-params.php中描述的 PHP 中设置变量方向。该文档没有提及在不同域上设置 cookie 的能力或不能力。
There is a different Stack Overflow threadon this same topic, but I don't think it was ever sufficiently answered.
在同一主题上有一个不同的Stack Overflow 线程，但我认为它没有得到充分的回答。
